Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser and AsyncParser recursive JSON parsing paths in parser/shared/src/main/scala/jawn/Parser.scala and parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker...

Jawn: Uncontrolled nesting depth in JSON parser

The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. Impact A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger java.lang.OutOfMemoryError. This is treated by Scala as a fatal error and not typically handl...

GHSA-CC4V-RVGP-2PF3 Jawn: Uncontrolled nesting depth in JSON parser

The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. Impact A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger java.lang.OutOfMemoryError. This is treated by Scala as a fatal error and not typically handl...

DEBIAN-CVE-2026-61814

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...

CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-61814

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...

DEBIAN-CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-61814

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...

UBUNTU-CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-55781-poc

CVE-2026-55781 — DoS del analizador UFS de NanaZip Asignación de memoria sin límites en el controlador UFS de NanaZip mediante un campo fsbsize controlado por el atacante. Resumen Campo| Valor ---|--- CVE| CVE-2026-55781 Aviso| GHSA-m34h-jf84-m74h Proveedor| M2Team / NanaZip Afectado| NanaZip = 6...

CVE-2026-59990 Jawn: Uncontrolled nesting depth in JSON parser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-59990 Jawn: Uncontrolled nesting depth in JSON parser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

EUVD-2026-85554

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-59990

The open-source JSON parser Jawn is vulnerable to a denial of service attack due to uncontrolled nesting depth in JSON arrays and objects. An attacker can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted , triggering a java.lang.OutOfMemoryError that is not handled by...

CVE-2026-59990 Jawn: Uncontrolled nesting depth in JSON parser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-61814

The Jawn open-source JSON parser is vulnerable to a denial of service (DoS) attack via CPU exhaustion in its AsyncParser component. The root cause is that AsyncParser can perform quadratic work (O(n^2)) when a single JSON token is delivered across many small chunks, as each absorb call rescans th...

CVE-2026-61814 Jawn: Quadratic parsing effort in AsyncParser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...

CVE-2026-61814 Jawn: Quadratic parsing effort in AsyncParser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...